0

I have a swf on localhost which tries to read a text file from another server - example.com. The text file is in a subdirectory as follows: example.com/test/example.txt

First here are the contents of the root and the sub-sirectory:

www.example.com:

/crossdomain.xml

<?xml version="1.0"?>   
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <site-control permitted-cross-domain-policies="master-only"/> 
    <allow-access-from domain="*" secure="false" />
</cross-domain-policy>

/test/crossdomain.xml

<?xml version="1.0"?>   
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
    <allow-access-from domain="*"/>
</cross-domain-policy>

/test/example.txt

Now if I explicitly mention in my actionscript as follows:

Security.loadPolicyFile("http://example.com/test/crossdomain.xml");

And then load: http://example.com/test/example.txt in the actionscript. Now the first action should be to check the master policy file under root to check if its meta-policy allows the loading of the crossdomain.xml from the test folder. Since here the meta-policy specifies "master-only", I am assuming the policy file specified by security.loadpolicyfile(), will not be loaded. But my question is after this check will the master policy file allow the access request of the text file from the test folder because of the policy <allow-access-from domain="*" secure="false" /> specified in the master policy file?

ssn
  • 2,631
  • 4
  • 24
  • 28
  • Have you tried this or anything to see how it behaves? Sorry, but it just seems like you could answer this trying it ... or at least share w/us the results of your "tests". – Sunil D. Apr 16 '13 at 05:09
  • The question was directed more at understanding whether it should be allowed as per security principles rather than verifying that it works. I have included my findings as the answer. Thanks. – ssn Apr 23 '13 at 22:40

1 Answers1

0

As per the Adobe Crossdomain policy spec,

  1. The swf sees that there is a crossdomain policy specified.
  2. It checks the master policy file to see if the specified policy file is permitted.
  3. Since the specified master policy file is not permitted, it DEFAULTS to load the master policy file and grant permission accordingly.
ssn
  • 2,631
  • 4
  • 24
  • 28
  • I'm not sure what this means but I'm trying to solve the same problem. When I switched my server to use https it started to have problems when testing locally. I've posted a similar question here, http://stackoverflow.com/questions/41318685/is-there-a-way-to-get-requests-to-work-when-calling-from-a-localhost-for-testing. – 1.21 gigawatts Dec 25 '16 at 04:48